Evidence-led validation
Run the smallest authorized check that resolves a claim, then retain an evidence-linked outcome even when the result is incomplete.
This is the complete downloadable file. Open plain text ↗
---
name: validation
description: "Run the smallest authorized check that resolves a claim, then retain an evidence-linked outcome even when the result is incomplete."
---
# Evidence-led validation
Run the smallest authorized check that resolves a claim, then retain an evidence-linked outcome even when the result is incomplete.
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
## Bring to the review
- A bounded hypothesis or security invariant
- Approved account and test conditions
- Evidence location and command or tool version
## Review guide
### 1. Define a decision
Write the expected allowed and denied outcome before testing. Favor owned objects and a minimal action that can decide the claim.
### 2. Record the actual result
When a local Hunt Workbench is available, call record_check with status, command or tool version, limits, outcome, evidence links, and next action. Do not flatten partial, blocked, failed, or not_tested into one result.
### 3. Update the claim
Use upsert_lead only to update the hypothesis and its missing proof. A validated finding requires direct evidence for the stated boundary; unresolved evidence remains a lead.
## MCP calls
Public research on the hosted MCP (generic topics only): `get_research_context`, `search_research`, `get_research_record`.
Durable records in the selected local workspace: `record_check`, `search_hunt_records`, `upsert_lead`.
Keep private evidence and scope records in the local workspace.
## What to produce
- Evidence-linked check record
- Accurate outcome state
- Updated proof gap or validated boundary
## Common mistakes
- Calling a blocked check a negative result
- Overwriting earlier evidence
- Escalating beyond the approved test condition
## Reading and source context
### Resources
- [OWASP Logging: trustworthy and minimal application evidence](https://vulns.co/research/resources/owasp-security-logging-evidence-quality/)
- [OWASP Secure Code Review: baseline and change-focused review](https://vulns.co/research/resources/owasp-secure-code-review-methodology/)
### Diagrams
- [Approval stays attached to the reviewed version](https://vulns.co/research/diagrams/approval-version-integrity/)
### Reports
- [Cloud Build approval was not bound to immutable code](https://vulns.co/research/reports/google-cloud-build-approval-toctou-2025/)
- [GitHub Actions trust depended on invalid repository references](https://vulns.co/research/reports/github-actions-reference-validation-2021/)
## Provenance
Editorial guide by vulns.co / GK Data. Updated 2026-10-12.
Library snapshot: 2026-10-04; commit d5550c7891119cf1379e235721541c947850a3b3.
The guide is an editorial synthesis. Linked records preserve their own sources and review dates.
Reader: https://vulns.co/skills/validation/
The review
What to look for
Defensive study and review of artifacts supplied by their owner. Record missing evidence as an open question.
Define a decision
Write the expected allowed and denied outcome before testing. Favor owned objects and a minimal action that can decide the claim.
Record the actual result
When a local Hunt Workbench is available, call record_check with status, command or tool version, limits, outcome, evidence links, and next action. Do not flatten partial, blocked, failed, or not_tested into one result.
Update the claim
Use upsert_lead only to update the hypothesis and its missing proof. A validated finding requires direct evidence for the stated boundary; unresolved evidence remains a lead.
What to produce
- Evidence-linked check record
- Accurate outcome state
- Updated proof gap or validated boundary
Common mistakes
- Calling a blocked check a negative result
- Overwriting earlier evidence
- Escalating beyond the approved test condition
Use with MCP
Take this into the workbench.
The hosted MCP reads public research. The separate local Hunt Workbench saves private project records in your chosen directory.
Public context
get_research_context search_research get_research_record
Local record tools
record_check search_hunt_records upsert_lead
Continue the study
Reading & source context
Editorial notes above connect these references. Open each record for its original source and review date.
Visual models
Connected disclosures
From the field toolkit
Guide by GK Data · Research snapshot 2026-10-04.
Sources and review dates are preserved in the library provenance.